Russian Hacking Group Sandworm Uses Clickfix Technique to Compromise Devices in Ukraine

The Ukrainian CERT center has reported that the Russian hacking group Sandworm is utilizing a technique known as Clickfix to compromise devices belonging to sensitive organizations in Ukraine. Clickfix, which has gained traction among financially motivated cybercriminals over the past year, involves attackers displaying a CAPTCHA on compromised websites that requires users to copy and paste a jumble of text into a terminal. This text contains scripts that can install malware or exfiltrate sensitive data. The Clickfix attacks began in the spring and have continued, resulting in at least one organization being compromised through the installation of a custom malware package called FreakyPoll. Ukrainian authorities identified 10 websites that displayed a fake CAPTCHA, which included a PowerShell command intended to trick users into believing they needed to complete it to verify their identity.